Restoring default privileges

[Frisk]

Hello,

I hope somebody can help me.

I have a win 2000 domain, and last week i experimented with the
restricted groups policy on the domain.

Basically i thought it was a good idea to allow my tech support staff
to be able to log onto any of our workstations (200+) with local
administrator privileges. I created a restricted group for
administrators and made the "tech" security group a member.

What i didn't realise is that restrictive groups work exclusively,
removing local administrator privileges from all other accounts.

In order to fix this problem and with a little help from Florian
(thanks) i removed the restrictive group and created a new restrictive
group for administrators and made domain/administrator and
domain/domain admins members.

This appeared to work when i logged onto workstations however not
everything has been properly restored.

I'm getting a few errors. Things like Veritas wont work. Veritas gives
me a "This service account does not have the necessary user right "Log
on as a service."" error even though the service account it uses is
administrator.

I'm also getting a "Security policies are propagated with warning.
0x534 : No mapping between account names and security IDs was done."
error which when i run some tests points to "Power Users" on the group
domain policy.

Whats the easiest way to restore the administrator account to its
default domain priviliges, the same priviliges it has over a domain
when installed. I really dont want to have to reinstall the pdc and
dc's again...

I would really appreciate any help.

Thanks

 

[Harj]

Hello,
There is an easy way in resetting the policies back to default.
Windows 2000 Default Group Policy Restore Tool
http://www.microsoft.com/downloads/...ae-b7dd-4bb5-ab2a-976d6873129d&displaylang=en
It is a free download from Microsoft.

good luck

 

[Frisk]

Will this reset the administrator account or just reset the policies?

I dont mind killing the policies but they would take some time to
restore and i dont want to do it if it doesnt affect the administrator
account.

 

[Harj]

Hello,

The above tool will reset the Default domain policy and the Default
domain controllers policy back to default (out of the box)
This will only touch the two policies I have mentioned above.

Harj
Powering Your Active Directory Investment
www.specopssoft.com

 

[Frisk]

Ok i tried this buddy, but it didnt reset the "administrator"
priviliges.

This is driving me nuts, how come its only microsoft stuff that doesnt
revert back to how it was when you switch a function off?!

Anyone have any ideas?

 

[Harj]

How to reset security settings back to the defaults
http://support.microsoft.com/?id=313222

I noticed the use of the Power Users group in your posting. We have to
remember....there is no such thing as a group called Power Users on a
Domain Controller.